Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters

Alerts on SharpSuccessor.exe command-line patterns indicative of Windows privilege escalation attempts.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2025-06-06
Updated: 2026-07-31

ATT&CK techniques

Priv Esc

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
- T1068Exploitation for Privilege Escalation
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process creation events where SharpSuccessor.exe is executed with command-line arguments indicating impersonation. An attacker could use this tool to attempt privilege escalation in Active Directory environments by leveraging the impersonation-related options. The detection relies on Windows process telemetry, specifically the executable name/path, original file name, and command-line contents.

Reporting behind it

Related detections9 linkedT1068 — drag to rearrange

Malicious EDR Evasion Driver Load from AnyDesk Directory via k.sys (via image_load)

Malicious Zemana Vulnerable Driver Load for EDR Termination (via image_load)

Suspicious EDRKillShifter Vulnerable Driver Load from User Temp Directory (via image_load)

Suspicious Process Explorer Kernel Driver Dropped as PED.sys via File Creation (via file_event)

Malicious Payload Download From copy.fail Exploit Host on Linux (via process_creation)

Suspicious su Execution From Uncommon Parent Process on Linux (via process_creation)

Possible noPac sAMAccountName Spoofing via Machine Account Rename

Possible macOS TCC Bypass via mdimport Loading Custom Spotlight Importer

Suspicious CLFS Base Log File Created in SkyPDF ProgramData Path during Zero-Day Exploitation (via file_event)

Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters

Pivot detection · T1068 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-sharpsuccessor-exe-execution-for-privilege-escalation-38a1ac5f

title: "Windows Process Creation: SharpSuccessor.exe Execution with Impersonation Parameters"
id: 35d01d4e-db7a-4767-aa23-05b0a8744202
status: experimental
description: This rule flags process creation events where SharpSuccessor.exe is executed with command-line arguments indicating impersonation. An attacker could use this tool to attempt privilege escalation in Active Directory environments by leveraging the impersonation-related options. The detection relies on Windows process telemetry, specifically the executable name/path, original file name, and command-line contents.
references:
  - https://github.com/logangoins/SharpSuccessor
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_sharpsuccessor_execution.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2025-06-06
tags:
  - attack.privilege-escalation
  - attack.t1068
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \SharpSuccessor.exe
    - OriginalFileName: SharpSuccessor.exe
    - CommandLine|contains: SharpSuccessor
    - CommandLine|contains|all:
        - " add "
        - " /impersonate"
        - " /path"
        - " /account"
        - " /name"
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 38a1ac5f-9c74-47d2-a345-dd6f5eb4e7c8
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL